SlowMist 披露 sol-live 仓库借 VS Code 终端配置植入窃密后门

🚨 Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor @SlowMist_Team recently received user reports about a GitHub repository named sol-live, presented as a #Solidity interview practice project. Analysis revealed a hidden download-and-execute command in .vscode/settings.json that can run a remote script when the project's custom terminal configuration is launched. 🔍 The retrieved payload contains three main modules capable of: 🔹 Collecting browser login databases and wallet extension storage, and copying #macOS Keychain files 🔹 Scanning and uploading local files 🔹 Executing remote commands, providing interactive shell access, and monitoring clipboard contents ⚠️ On macOS/Linux, execution requires users to actively launch the malicious terminal configuration. The #Windows execution chain remains unconfirmed due to potential quoting issues. We also identified 8 other #GitHub projects with similar terminal-based download-and-execute techniques. The

来源：SlowMist_Team · x.com